Authorization & Role-Based Access Control (RBAC)

[levelslip]

• Description: Implement Express middleware for RBAC
• Activities:
  • Create requireAuth middleware to verify JWT and attach user object to req.user
  • Create requireRole(roles[]) middleware to restrict endpoint access (PATIENT, DOCTOR, ADMIN)
  • Implement resource-level access checks (e.g., patient can only fetch their own bookings)
  • Apply middleware to routing files appropriately
• Deliverables: Auth and Role middleware, secured routing files